EUVD-2026-42120
GHSA-r42h-hrr3-8vrv
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file-parsing flaw needing a user to open malicious content, so AV:L and UI:R with PR:N; successful code execution yields full C/I/A on the affected host.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
Lifecycle Timeline
1DescriptionCVE.org
The application contains an out-of-bounds write vulnerability that can be exploited by an attacker to cause the program to write data past the end of an allocated memory buffer. This can lead to arbitrary code execution.
AnalysisAI
Arbitrary code execution via an out-of-bounds write (CWE-787) affects an industrial control system product covered by CISA ICS advisory ICSA-26-188-06, where an attacker can corrupt memory past an allocated buffer to run code in the context of the affected application. The CVSS 4.0 vector (AV:L/UI:A) indicates the flaw is triggered locally and requires a victim to actively interact - consistent with opening a malicious file or project in engineering/HMI software. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the high-impact memory corruption and DHS ICS-CERT reporting warrant prompt patching in OT environments.
Technical ContextAI
The root cause is CWE-787 (Out-of-bounds Write), a memory-corruption class in which the application writes data beyond the bounds of an allocated buffer - typically from missing or incorrect bounds validation during parsing of attacker-controlled input. In ICS/OT software this pattern most often appears in file/project parsers, proprietary protocol handlers, or firmware image processors. A controlled out-of-bounds write can overwrite adjacent heap/stack structures, function pointers, or return addresses, which is why the tags escalate it to Buffer Overflow / Memory Corruption / RCE. The specific affected product, component, and CPE strings were not provided in the source data; the only artifact is the CISA ICS advisory reference (ICSA-26-188-06) and DHS ICS-CERT (ics-cert@hq.dhs.gov) as the reporter.
RemediationAI
Apply the vendor-provided update referenced in CISA advisory ICSA-26-188-06 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-188-06); no exact fixed version was included in the source data, so confirm the patched release directly from that advisory. Because exploitation requires a user to open attacker-supplied content locally, effective compensating controls are: restrict which files/projects the affected software will open to trusted, signed sources only; train operators not to open untrusted project/configuration files; and isolate engineering workstations and HMI hosts on segmented OT networks with application allow-listing to limit code execution - noting that allow-listing can break legitimate updates if not maintained. Follow CISA's standard ICS mitigations (minimize network exposure, place control systems behind firewalls, use secure remote access) as documented in the advisory.
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today